Windows 2000 Non-Paged Pool Is Exhausted by Afd.sys

Symptoms

Under certain circumstances, heavy usage of Winsock programs can cause non-paged pool memory to become exhausted. This behavior is likely to occur if the Winsock program is dealing with both Out-of-Band (MSG_OOB) and normal TCP traffic. This situation can cause various error messages and poor performance, and can cause the computer to stop responding (hang). Examples of possible error messages include:

Other events may not work and may generate status code 1450 ("Insufficient System Resources").

Cause

A non-paged pool memory leak occurs in Afd.sys if a Winsock program does not correctly post a Receive to collect the incoming data from Winsock. Afd.sys may endlessly buffer the data and use up all non-paged memory. Afd.sys should check the MaxBufferredReceiveBytes value for the socket and then not buffer more than this value.

Resolution

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack
The English version of this fix should have the following file attributes or later:


Date Time Version Size File name
-----------------------------------------------------------
4/16/2001 04:40p 5.0.2195.3503 118,800 Afd.sys
4/16/2001 04:42p 5.0.2195.3417 104,720 Msafd.dll
4/9/2001 03:25p 5.0.2195.3475 311,472 Tcpip.sys
4/6/2001 05:55p 5.0.2195.3474 16,208 Tdi.sys
4/16/2001 04:42p 5.0.2195.2104 17,680 Wshtcpip.dll

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

More Information

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product
For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot
You can identify this problem by following the instructions in the following Microsoft Knowledge Base article:

177415 How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks
The results show AfdB leaking non-paged pool over time:

            
Memory:  523816K Avail:  274204K  PageFlts:   971   InRam Krnl: 1396K P:17256
 Commit: 208392K Limit:1278740K Peak: 227040K            Pool N:20284K P:17416
 Tag  Type     Allocs            Frees            Diff   Bytes      Per Alloc


 AfdB Nonp     288886 (  17)    285160 (  21)     3726 6887776 (  2080)   1848
 MmCm Nonp         26 (   0)         3 (   0)       23 1286432 (     0)  55931
 File Nonp    1521215 ( 546)   1513387 ( 467)     7828 1255584 ( 12640)    160
 Irp  Nonp   15969583 (6156)  15966363 (6211)     3220 1225088 (-11232)    380
 TCPT Nonp       2010 (   0)         0 (   0)     2010  900480 (     0)    448

The same problem exists in Microsoft Windows NT 4.0. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

293841 Non-Paged Pool Is Exhausted by Afd
For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes